GGNTER SCHWESIG, citizen of Germany, whose residence and 
post office address is, Lange Zeile 84, 91054 Erlangen, Germany, has invented 
certain new and useful improvements in a 



METHOD AND DEVICE FOR RELIABLY SWITCHING AN 
OPERATING MODE OF AN INDUSTRIAL CONTROLLER FOR 
MACHINE TOOLS OR PRODUCTION MACHINES 



of which the following is a complete specification: 



METHOD AND DEVICE FOR RELIABLY SWITCHING AN 
OPERATING MODE OF AN INDUSTRIAL CONTROLLER FOR 
MACHINE TOOLS OR PRODUCTION MACHINES 

CROSS-REFERENCES TO RELATED APPLICATIONS 

[0001] This application claims the priority of German Patent Application, 
Serial No. 103 15 526.0, filed April 4, 2003, pursuant to 35 U.S.C. 1 19(a)-(d), the 
disclosure of which is incorporated herein by reference. 

BACKGROUND OF THE INVENTION 

[0002] The present invention relates to a method and a device for reliably 
switching an operating mode of an industrial controller for a machine tool or 
production machines. In the following description, the term "production machine" 
is used in a generic sense and includes robots which generally follow the 
concepts outlined here. 



[0003] Machine tools and production machines require certain safety 
procedures for their operation to protect people from dangerous movements of 
workpieces and machine elements. In particular, the safety procedures are 
intended to prevent unintended movements of workpieces or machine elements 
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that could endanger an operator. 



[0004] Each machine has several operating modes, for example automatic 
production, setup mode and manual mode. The settings for the various 
protective measures, such as the maximum permitted travel path or the 
maximum permitted travel speed, are defined when the desired operating mode 
is selected. Only qualified personnel especially trained for operating the 
machine should be allowed to select or switch the operating mode. In general, 
modern industrial controllers for machine tools or production machines have key 
authentication switches with redundantly implemented, galvanically separated 
contacts for safely selecting and/or switching the operating mode. For operating 
the controller, the various contacts are each connected individually to a control 
panel, whereby the controller properly evaluates and processes the switch 
position of the key authentication switch. Read errors, wiring defects and switch 
malfunctions are identified by comparing the two read-in switch position values. 

[0005] FIG. 1 shows a conventional operator's console 1 of an industrial 
controller for machine tools or production machines. The operator's console 1 
includes essentially two rotary switches 2a and 2b, and a standard keypad 3a 
with nine standard keys, whereby for sake of clarity only one standard key 4a is 
labeled, and another standard key pad 3b that also includes nine keys, whereby 
also only one key 4b is labeled for sake of clarity. The operator's console also 
includes a terminal strip 5 with eight individual contacts. 
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[0006] FIG. 2 shows a three-step key authentication switch 6. The three- 
step key authentication switch 6 has eight contacts, wherein only one contact 9 
is labeled for sake of clarity. A mechanical coupling 8 is provided to ensure that 
the upper four contacts are switched synchronously with the lower four contacts 
when the key 7 is turned, as depicted in FIG. 2. The eight contacts of the three- 
step key authentication switch 6 are electrically connected separately with a 
corresponding single contact of a terminal strip 5, as shown in FIG. 1. A total of 
eight electrically conducting connections between the operator's console 1 and 
the three-step key authentication switch 6 are required in order to switch 
between the two different operating modes. A single operating mode is 
associated with each step of the key authentication switch 6. 

[0007] Only one qualified operator has the key 7 and can select the 
desired operating mode by turning the key 7. Two corresponding redundant 
contacts and one operating mode are associated with each switch position. The 
contacts are connected via two electrically conducting, galvanically separated 
connections to an operator's console with failsafe inputs. The signals from the 
contacts are evaluated and processed in the operator's console and/or the 
controller. A device of this type and a corresponding method for securely 
switching between operating modes of an industrial controller for machine tools 
or production machines, however, has several disadvantages. These are in 
particular: 
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High cost of the three-step or multi-step redundant key authentication 
switch. 

Large installation size of the three-step or multi-step redundant key 
authentication switch. 

For each operating mode two contacts and/or two terminals are required 
on both the operator's console and the key authentication switch, hence 
requiring a large number of contacts (this does not include the two 
contacts for the power supply). 

Complicated wiring because of the need to provide per operating mode 
two electric connections between operator's console and key 
authentication switch (this does not include the two connections for the 
power supply). 

The switch position of the key authentication switch is oftentimes difficult 
to mark, since the switch is typically installed externally. 
The number of the operating modes is limited by the maximum number of 
possible steps of the key authentication switch. 

[0008] It would therefore be desirable and advantageous to provide an a 
simple, safe and cost-effective device and method for safety switching between 
operating modes of an industrial controller for machine tools or production 
machines. 
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SUMMARY OF THE INVENTION 



[0009] According to one aspect of the present invention, a method for 
securely switching between operating modes of an industrial controller for 
machine tools or production machines includes the steps of identifying an 
operator before switching between the operating modes and transmitting to an 
operator's console of the controller a redundant binary enable signal if the 
operator is successfully identified. If the operator's console receives the enable 
signal and determines that the enable signal is error-free, the operator is allowed 
to switch between the operating modes by using at least one key of the 
operator's console. The key is implemented in safe technology. 

[0010] According to another aspect of the present invention, a device for 
securely switching between operating modes of an industrial controller for 
machine tools or production machines includes identification means for 
identifying an operator before switching between the operating modes and an 
operator's console of the controller that receives from the identification means a 
redundant binary enable signal if the operator is successfully identified. At least 
one key is located on the operator's console and implemented in safe 
technology. The key or keys enable the operator to switch between the operating 
modes if the operator's console receives from the identification means the 
enable signal and determines that the enable signal is error-free. 
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[0011] According to another advantageous feature of the present 
invention, the identification means can be externally connected to the operator's 
console. In this way, the number of identification means that can be connected 
to the operator's console is not limited. 

[0012] According to yet another advantageous feature of the present 
invention, the identification means can include a key authentication switch, which 
are commonly used as identification means. Suitably, the key authentication 
switch can be a two-step key authentication switch, which can be quite cost- 
effective. 

[0013] According to another feature of the present invention, the key 
identification switch can be a switch with a key that automatically returns to its 
rest position and interrupts the enable signal when the key is released. This 
forces the operator to use one hand to prevent the key from returning to its initial 
position when selecting a new operating mode, while selecting the new operating 
mode using the other hand. The operating mode can thereby be securely 
switched. 

[0014] A user or operator can be reliably identified by using as an 
identification means an identification card or a transponder or a biometric 
method, in particular a fingerprint or a retina scan. 
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BRIEF DESCRIPTION OF THE DRAWING 



[0015] Other features and advantages of the present invention will be 
more readily apparent upon reading the following description of currently 
preferred exemplified embodiments of the invention with reference to the 
accompanying drawing, in which: 

[0016] FIG. 1 is a schematic illustration of a conventional operator's 
console with eight contacts; 

[0017] FIG. 2 is a schematic illustration of a conventional three-step 
key authentication switch with eight contacts; 

[0018] FIG. 3 is a schematic illustration of an operator's console 
with four contacts in accordance with the present invention; and 

[0019] FIG. 4 is a schematic illustration of a two-step key 
authentication switch with four contacts. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

[0020] Throughout all the Figures, same or corresponding elements are 
generally indicated by same reference numerals. These depicted embodiments 
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are to be understood as illustrative of the invention and not as limiting in any 
way. It should also be understood that the drawings are not necessarily to scale 
and that the embodiments are sometimes illustrated by graphic symbols, 
phantom lines, diagrammatic representations and fragmentary views. In certain 
instances, details which are not necessary for an understanding of the present 
invention or which render other details difficult to perceive may have been 
omitted. 

[0021] Turning now to the drawing, and in particular to FIG. 3, there is 
shown a schematic illustration of an operator's console 31 according to the 
present invention, including two rotary switches 2a and 2b, a standard key 
pad 3a with nine standard keys, of which only one standard key 4a is labeled for 
sake of clarity. Parts corresponding with those in FIG. 1 are denoted by identical 
reference numerals and not explained again. The description below will center 
on the differences between the embodiments. In accordance with the present 
invention, the operator's console 31 has a key pad 12 that is implemented in a 
safe technology, with nine keys implemented in safe technology, of which only 
one key 13 is labeled for sake of clarity. In addition, the operator's console 31 
has a terminal strip 35 with only for individual contacts. 

[0022] To ensure clarity, it is necessary to establish the definition of the 
term "safe technology" that will be used throughout this disclosure. As already 
mentioned, the operator's console 31 of FIG. 3, unlike the operator's console 1 in 
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FIG. 1, has two different key pads 3a and 12. The key pad 3a and the keys 4a 
of the key pad 3a are implemented as standard keys, whereas the key pad 12 
and the associated keys 13 are implemented in the so-called safe technology. 
The keys 13 implemented in safe technology are read-in from the operator's 
console and/or the controller by special methods or procedures in a particularly 
secure and reliable manner. This can be achieved in different ways, for 
example, by providing the keys 13 with redundant contacts, as in the key 
authentication switch, and/or by reading the values in redundantly. In addition, 
the two read-in values in the operator's console and in the controller can be 
compared to thus identify a read error, a wiring defect and/or a switch 
malfunction. The additional expense for implementing the keys in safe 
technology as compared to standard technology is insignificant. 

[0023] FIG. 4 shows a functional circuit diagram of a two-step key 
authentication switch 10. This switch essentially corresponds to the three-step 
key authentication switch 6 depicted in FIG. 2. Each of the two contacts is 
switched redundantly and synchronously by a key 7 via a mechanical coupling 8. 
Unlike the three-step key authentication switch 6 depicted in FIG. 2, the two-step 
authentication switch 10 of FIG. 4 has only four contacts, with only one contact 9 
labeled for sake of clarity. 

[0024] The four contacts of the two-step key authentication switch 10 of 
FIG. 4 are each separately connected via a corresponding connection to 
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respective contacts of the terminal block 5 of the operator's console 1, as 
depicted in FIG. 3. 

[0025] If a qualified operator desires to switch the operating mode, then 
the operator inserts the key 7 into the two-step key authentication switch 10 and 
turns the key. In this way, the upper and lower contact of the two-step key 
authentication switch 10 of FIG. 4 are synchronously closed and a binary 
redundant enable signal, which consists of the two individual enable signals 14 
and 15 depicted in FIG. 3 and FIG. 4, is transmitted to the operator's console 1 
via the respective contacts. As long as the operator's console receives the 
redundant enable signal and does not detect an error in the enable signal (both 
of the enable signals 14 and 15 must have the same logical value, for example 
"0" or "1"), then all keys of the key pads 12 or a subset thereof constructed in 
safe technology are enabled and can be operated by the qualified operator. 

[0026] In the depicted embodiments, one operating mode is associated 
with each enabled key that is configured with the safe technology. As long as 
the enable signal is applied, the operator can select the desired operating mode 
by pressing the corresponding key. However, instead of associating a single 
operating mode with each key as shown in the depicted exemplary embodiment, 
the same or an even greater number of operating modes than the afore- 
described nine different enabled operating modes (corresponding to the number 
of keys) can be defined and/or selected when using a menu that is controlled by 
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the keys or by an even smaller number of keys. 



[0027] After the operating mode is switched, the qualified operator returns 
the key 7 again into the initial position, thereby interrupting the enable signal and 
blocking the keys of the key pad 12. 

[0028] Unlike conventional methods and devices, the methods and the 
device of the invention depicted in FIGS. 3 and 4 only require four contacts on 
the operator's console 1 and on the key authentication switch 10, so that a two- 
step key authentication switch can be used. In addition, in the depicted 
exemplary embodiment only four wired connections are required between the 
operator's console 1 and the two-step key authentication switch 10 (see FIGS. 3 
and 4), instead of the eight connecting wires required in the conventional 
embodiment depicted in FIGS. 1 and 2. 

[0029] This significantly reduces the cost and wiring complexity and 
improves the reliability. 



[0030] In the depicted exemplary embodiment, an externally connected 
key authentication switch is provided as an identification means. However, it will 
be appreciated by those skilled in the art that the identification means or the key 
authentication switch can also be an integrated component of the operator's 
console 1. The contacts can then be located inside the housing of the operator's 
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console 1 and are not visible to the externally located operator. 

[0031] Instead of using a key authentication switch, the identification 
means can also be implemented as an identification card, a transponder or a 
biometric unit, such as a fingerprint or a retina scanner. 

[0032] If the identification means is connected externally to the operator's 
console, then the identification means can be easily exchanged at a later time. 

[0033] It will be understood that a three-step or multi-step key 
authentication switch can also be used instead of the two-step key authentication 
switch. The unused contacts of the key authentication switch are then not 
connected. Such a three-step or multi-step key authentication switch, however, 
can be expected to be more expensive than a two-step key authentication 
switch. 

[0034] If the key authentication switch is implemented so that the key 
automatically returns to its initial position and the enable signal is interrupted 
when the key is released, then the user is forced to use both hands when 
switching between operating modes. The operator has to use one hand to hold 
the key in the turned position to prevent the key form returning to its initial 
position, while selecting using the other hand to select the operating mode with 
the keys 13 of the keypad 12 implemented with safe technology. This 
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arrangement reduces the risk that the operating mode is switched unintentionally 
of by pressing the wrong key or by dropping objects on the keys. 

[0035] If an identification card or a retina scan of the user's eye is used as 
identification means, then the enable signal can remain activated for a short time 
after the identification. This time should be sufficient to switch the operating 
mode, and giving the user with an unobstructed view of the keys to be pressed. 

[0036] FIG. 3 shows an exemplary operator's console 1 with optional 
identification means in the form of a fingerprint scanner 11, schematically 
indicated by dotted lines. Optionally, the indicated fingerprint scanner 1 1 and the 
two-step key authentication switch 10 can also operate in parallel, so that the 
operator can use for identification, for example, either the fingerprint scan 1 1 or 
the two-step key authentication switch 10 or both, which provides additional 
security. 

[0037] While the invention has been illustrated and described in 
connection with currently preferred embodiments shown and described in detail, 
it is not intended to be limited to the details shown since various modifications 
and structural changes may be made without departing in any way from the spirit 
of the present invention. The embodiments were chosen and described in order 
to best explain the principles of the invention and practical application to thereby 
enable a person skilled in the art to best utilize the invention and various 
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embodiments with various modifications as are suited to the particular use 
contemplated. 

[0038] What is claimed as new and desired to be protected by Letters 
Patent is set forth in the appended claims and includes equivalents of the 
elements recited therein: 
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